Sploitus

Exploit for Mac OS X rsh Environment Variables Privilege Elevation

CVE-2015-5889

saint · 2015-10-15

Exploit Code

MARKDOWN31 lines
## https://sploitus.com/exploit?id=SAINT:5A2B8BE492460005E2B67FB7305B1795
Added: 10/15/2015  
CVE: [CVE-2015-5889](<https://vulners.com/cve/CVE-2015-5889>)  


### Background

The `**remote_cmds**` component of Apple Mac OS X contains an rsh binary program that allows a user to execute commands on another computer across a computer network. 

### Problem

The rsh binary in the remote_cmds component of Mac OS X versions prior to 10.11 allows an unprivileged user to gain root access by using specially crafted environment variables when using rsh. 

### Resolution

Upgrade to Apple Mac OS X El Capitan v10.11 or higher. 

### References

<https://support.apple.com/en-us/HT205267>  


### Limitations

Exploit works on Mac OS X 10.9.5 and 10.10.5 and requires an existing unprivileged shell connection to the target. 

If the exploit succeeds, the `**/etc/crontab**` and `**/etc/sudoers**` files should be cleaned up on the target. 

### Platforms

Mac OS X